* Description: * HandleCommand is responsible for handling an anti analysis related command. * * Parameters: * @command [_In_ std::string] -- The comm

* Description: * HandleCommand is responsible for handling a network related command. * * Parameters: * @command [_In_ std::string] -- The command

* Description: * Hide is responsible for issuing a IOCTL_HIDE_UNHIDE_THREAD to hide or unhide a thread. * * Parameters: * @tid [_In_ DWORD] -- Th

* Description: * Hide is responsible for issuing a IOCTL_HIDE_UNHIDE_PORT to hide or unhide a port. * * Parameters: * @portNumber [_In_ USHORT] --

* Description: * HideDriver is responsible for hiding a driver. * * Parameters: * @driverPath [_In_ std::wstring] -- The path of the driver to be

* Description: * HideKey is responsible for hiding or unhiding a registry key. * * Parameters: * @key [_In_ const std::wstring&] -- The registry key

* Description: * HideModule is responsible for hiding and restoring a module inside a process. * * Parameters: * @pid [_In_ DWORD] -- The PID

* Description: * * HideValue is responsible for hiding or unhiding a registry value. * * Parameters: * @key [_In_ const std::wstring&] -- The regi

* Description: * InjectDll is responsible for injecting a DLL into a process. * * Parameters: * @pid [_In_ DWORD] -- The PID of the target process

* Description: * InjectShellcode is responsible for injecting shellcode into a process. * * Parameters: * @pid [_In_ DWORD] -- The PID of the targ

* Description: * ListProtectedFiles is responsible for listing all currently protected files. * * Parameters: * @type [_In_ FileType] -- The type

* Description: * ListHiddenPorts is responsible for issuing a IOCTL_QUERY_HIDDEN_PORTS to get all hidden ports. * * Parameters: * There are no par

* Description: * ListKeys is responsible for listing all registry keys. * * Parameters: * @type [_In_ RegItemType] -- The type of registry items

* Description: * ListObCallbacks is responsible for listing all object callbacks of a specific type. * * Parameters: * @callbackType [_In_ CallbackTy

* Description: * ListPsRoutines is responsible for listing all PS routines of a specific type. * * Parameters: * @callbackType [_In_ CallbackType] --

* Description: * ListRegistryCallbacks is responsible for listing all registry callbacks. * * Parameters: * There are no parameters. * * Returns: *

* Description: * ListProtectedThreads is responsible for issuing a IOCTL_QUERY_PROTECTED_THREADS to get all protected threads. * * Parameters: * T

* Description: * ListProtectedValues is responsible for listing all protected registry values. * * Parameters: * @type [_In_ RegItemType] -- The ty

* Description: * LoadImageNotifyDummyFunction is a dummy function for load image notify routine. * * Parameters: * @FullImageName [PUNICODE_STRING] --

* Description: * LoadNof is responsible for loading a NOF. * * Parameters: * @data [_In_ std::vector<byte>] -- The NOF data. * @entryPointNam

* Description: * Log is responsible for logging messages to the debugger. * * Parameters: * @logLevel [_In_ LogLevel] -- The log level. * @format

* Description: * ObPostOpenDummyFunction is a dummy function for post ob callbacks. * * Parameters: * @RegistrationContext [PVOID] -- Unused.

* Description: * ObPreOpenDummyFunction is a dummy function for pre ob callbacks. * * Parameters: * @RegistrationContext [PVOID] -- Unused. *

* Description: * OnPreOpenProcess is responsible for handling process access operations and remove certain permissions from protected processes. * * P

* Description: * OnPreOpenThread is responsible for handling thread access operations and remove certain permissions from protected threads. * * Param

* Description: * OnProcessCreationExit is responsible for restoring hidden modules when a process exits. * * Parameters: * @parentId [_In_ HANDLE]

* Description: * ParseRegistryKey is responsible for parsing the registry key from the input string. * * Parameters: * @key [_In_ const std::wstring&

* Description: * PatchAmsi is responsible for patching AMSI in a process. * * Parameters: * @pid [_In_ DWORD] -- The PID of the target process. *

* Description: * PatchEtw is responsible for patching ETW in a process. * * Parameters: * @pid [_In_ DWORD] -- The PID of the target process. *

* Description: * PatchModule is responsible for patching a module inside a process. * * Parameters: * @pid [_In_ DWORD] -- The PID of the target p

* Description: * PrepareApcCallback is responsible for force the APC execution. * * Parameters: * @Apc [PKAPC] -- The received APC. * @Norma

* Description: * Protect is responsible for issuing a IOCTL_PROTECT_UNPROTECT_THREAD to protect or unprotect a thread. * * Parameters: * @tid [

* Description: * Protect is responsible for protecting or unprotecting a file path from being deleted. * * Parameters: * @filePath [_In_ std::wstring]

* Description: * ProtectKey is responsible for protecting or unprotecting a registry key. * * Parameters: * @key [_In_ const std::wstring&] -- The

* Description: * ProtectValue is responsible for protecting or unprotecting a registry value. * * Parameters: * @key [_In_ const std::wstring&] --

* Description: * RegistryCallbackDummyFunction is a dummy function for registry callbacks. * * Parameters: * @CallbackContext [PVOID] -- Unused. * @Ar

* Description: * RemoveCallback is responsible for removing or restoring a callback. * * Parameters: * @callbackAddress [_In_ ULONG64] -- The addr